Bookshelf
Security books, adjacent thinking, and the concepts that improve how defenders reason and communicate.
Personal reading notes, not affiliate recommendations.
A reading note on the AI-assisted credential-harvesting lifecycle in Anthropic’s September 2026 threat report.
The useful defender question is what a working token allowed an attacker to create, export, or reach next. This note turns the reported sequence into investigation prompts for identity, cloud, SaaS, and data-access evidence.
A practical reading note on moving from a system diagram to credible attack scenarios—and using those scenarios to make better risk decisions.
Start with scope, decompose the system into components and data flows, mark trust boundaries, use STRIDE-LM to prompt threat questions, then connect individual events into attack paths that reveal where controls and evidence matter most.
A practical introduction to security operations, covering SOC and CSIRT responsibilities, SIEM capabilities, incident-response workflows, common infection vectors, and detection-and-response technologies.
Key idea: an effective SOC is more than a collection of security tools. It connects visibility and detection with documented procedures, investigation questions, clear ownership, containment, and response. The guide is especially useful for understanding how antivirus, EDR, NDR, MDR, and XDR support different parts of security operations.
A useful bridge between intelligence practice and the operational reality of incident response.
Key idea: indicators describe artifacts; adversary behavior provides context that can improve both investigation and future detection.
A foundation for thinking about visibility, evidence, and network-centric investigation.
Key idea: collection is valuable only when it supports analysis, escalation, and a repeatable response process.
A compact model for understanding which detections create the greatest cost for an adversary.
Key idea: detections based on tools, techniques, and behavior tend to be more durable than atomic indicators.
Not a security book, but a powerful guide to feedback, structure, and unintended consequences.
Key idea: defensive outcomes emerge from incentives, delays, workflows, and feedback loops—not isolated controls.